Loading story…
Threat activity in 2025 increasingly targeted developer environments and software supply chains, with Sonatype reporting more than 450,000 newly identified malicious open-source components and a heavy concentration in the npm ecosystem. Campaigns were characterized by automation and scale: attackers published large batches of similarly named packages, rapidly re-uploaded them after takedowns, and in some cases achieved lateral propagation through developer machines and linked projects, compromising downstream components within days. The reporting highlights a shift away from end-user targeting toward build tools, developer workstations, and CI/CD pipelines, and warns that smaller ecosystems should adopt mature controls (e.g., stronger access controls and 2FA) before abuse scales.
A separate incident illustrates the impact of developer-environment compromise: roughly 860GB of Target source code and internal developer documentation reportedly appeared online, with employees confirming authenticity. Threat researchers assessed the intrusion likely began with an infostealer infection on an employee workstation in late 2025, enabling theft of credentials/session tokens and subsequent access to internal services (e.g., IAM, Confluence, Jira) and code repositories over several months before detection. After discovery, Target reportedly took its Git server offline and tightened VPN/access controls, with internal notes suggesting repository access controls may have been misconfigured—reinforcing the broader trend of attackers using compromised developer endpoints and weakly protected engineering infrastructure to exfiltrate sensitive code and pipeline details.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
In the same report, Sonatype attributed hundreds of 2025 malicious npm package releases to North Korea's Lazarus Group. The packages were described as multi-stage malware using droppers, credential theft, persistence, and rapid republishing with reused code and infrastructure.
Sonatype reported that more than 450,000 new malicious open source components were identified during 2025, with activity heavily concentrated in npm and focused on developer environments, build tools, and CI/CD pipelines. The company said install-time execution was a common tactic for credential theft, payload delivery, and persistence.
After discovering the incident, Target reportedly took its Git server offline and limited access to the corporate VPN. Internal memos also referenced an accelerated change to access controls in response to the breach.
Current and former Target employees reportedly confirmed by January 13, 2026 that the leaked source code and internal documentation were authentic. Their confirmation validated that the exposed materials belonged to Target's internal environment.
About 860GB of Target source code and internal developer documentation was reported to have appeared online on January 12, 2026. The leak reportedly exposed around 57,000 file and directory names and extensive internal development information.
Using the compromised identity's access to systems including IAM, Confluence, Jira, internal wikis, and Git resources, the attacker reportedly carried out sustained data theft over roughly three to four months. The activity allegedly exposed internal technology stack details, CI/CD information, Hadoop datasets, and engineer metadata.
Threat intelligence researchers assessed that the Target source-code theft likely began in late September 2025 with an infostealer infection on an employee workstation. The malware allegedly enabled theft of credentials and session tokens tied to broad internal access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **software supply chain** threats targeting developers via public package ecosystems. Tenable analyzed a malicious npm package, **`ambar-src`**, that reached roughly **50,000 downloads** in days before removal; it executed during installation via **malicious `preinstall` behavior**, used evasion techniques, and dropped OS-specific payloads for Windows, Linux, and macOS, with typosquatting assessed as the likely lure (mimicking *`ember-source`*). Separate reporting described a campaign using **malicious NuGet packages** (e.g., **NCryptYo**, **DOMOAuth2_**, **IRAOAuth2.0**, **SimpleWriter_**) that impersonated legitimate .NET libraries, executed code on assembly load, and established local proxying/backdoor behavior to facilitate credential theft and persistence in ASP.NET environments. Additional coverage warned of an npm “worm-like” propagation pattern impacting **CI pipelines and AI coding tools**, reinforcing that developer tooling and build systems are high-risk choke points where a single poisoned dependency can spread quickly across environments. While the broader set of articles also included unrelated breach, ransomware, and policy items, the developer-focused supply chain reporting consistently emphasized that **installation-time execution** and **typosquatting/impersonation** enable compromise even when developers never directly call the malicious code, and that traditional detection can lag (e.g., low initial antivirus detection rates for obfuscated .NET payloads).
Jun 29, 2026
Open-source software supply chain risk continued to escalate, with reporting citing **454,600+** newly identified malicious packages across major repositories (including **PyPI, npm, Maven Central, NuGet, and Hugging Face**) and tactics ranging from **credential theft** to **multi-stage attacks** and even early **self-replicating** package malware. The activity reportedly concentrated heavily in **npm**, including high-volume “ecosystem flooding” (e.g., single accounts publishing **150,000+** malicious packages in days) and **hijacking of trusted projects**, exploiting developer reliance on superficial trust signals such as package names, READMEs, and download counts. Separately, researchers disclosed **“PackageGate”** vulnerabilities in JavaScript package managers (**npm, pnpm, vlt, and Bun**) that can bypass common post-incident defenses—namely `--ignore-scripts` and lockfile integrity—enabling malicious code execution via compromised dependencies. Koi Security reported six issues; **pnpm, vlt, and Bun** shipped fixes, while **npm** reportedly treated the behavior as expected. In parallel, threat actors abused **GitHub’s fork architecture** to distribute a spoofed *GitHub Desktop* installer promoted via search ads; execution deployed **HijackLoader** and established persistence via a **scheduled task**, underscoring that supply chain threats extend beyond package registries into developer tooling distribution channels.
Jun 29, 2026
A supply-chain compromise in the `react-tracked` GitHub repository led to attacker-controlled code execution during `npm install` after malicious commits briefly landed on the default branch. The implant added `src/install.js` and a `postinstall` hook that fetched and evaluated a remote JavaScript payload from an attacker-controlled HTTPS endpoint, disabled TLS verification, and avoided CI and cloud or serverless environments to focus on developer workstations. Although the tainted code was never published to npm and was later force-pushed away, any developer who installed from an affected checkout, fork, local clone, or direct commit reference may have been exposed; impacted systems should be treated as fully compromised and reachable credentials rotated. The incident fits a broader wave of developer-focused software supply-chain attacks that has intensified across GitHub, npm, PyPI, Docker Hub, and CI/CD environments. Recent reporting tied the March 2026 compromises of tools including Trivy, Checkmarx KICS, and LiteLLM to TeamPCP, a threat cluster Oligo Security says overlaps with the longer-running TA-NATALSTATUS and ShadowRay 2.0 activity through shared infrastructure, staging paths, and deployment scripts. Researchers say these campaigns increasingly abuse trusted developer platforms, steal tokens, and use malicious repositories, workflows, and packages to reach workstations and cloud-connected build environments.
Aug 12, 2026